Azure Resource Group Provisioning from Service Request

Overview

This flow delivers self-service, governed Azure environments. When a landing-zone request row is created in Dataverse, the flow gates it through a platform Approval, then provisions a new resource group via Azure Resource Manager with the org-standard tags, assigns a baseline policy and an RBAC role, sets a monthly Cost Management budget, writes the outcome back to the request row, emails the requester, and posts a summary to Teams. Rejected requests are recorded and the requester is notified.

Why it matters: Hand-built environments drift from standards and slow teams down. Templated, approval-gated provisioning gives developers what they need quickly while guaranteeing tags, policy, access, and budget are correct from day one — with a full Dataverse audit trail.

> Status: Built (ships Off). Going live requires only authorizing the four connections and setting the environment-variable values (no logic changes).

Use Case

A platform / cloud-governance team wants developers to request an environment and receive a correctly-governed resource group automatically — no manual setup, no missed guardrails. Each request is captured as a Dataverse row, reviewed via Approvals, and on approval the resource group is created with guardrails and a budget already in place.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Approvals	shared_approvals	StartAndWaitForAnApproval
Microsoft Dataverse	shared_commondataserviceforapps	SubscribeWebhookTrigger UpdateRecord
Office 365 Outlook	shared_office365	SendEmailV2
Microsoft Teams	shared_teams	PostMessageToConversation

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Naming convention

Edit Initialize Resource Group Name to change the {team}-{purpose}-rg pattern (e.g. add the environment type or a region code).

Bicep / ARM template

After Create Resource Group, add an HTTP PUT …/deployments/{name}?api-version=2021-04-01 to deploy a baseline template (networking, logging, Key Vault) into the new RG.

Expiry & auto-clean

Add an expiresOn tag from the request and a companion scheduled flow that deallocates/deletes temporary environments past expiry.

Richer budget alerts

Extend Set Resource Group Budget notifications with Forecasted thresholds or additional contact roles/groups.

Principal type

Assign Rbac Role defaults principalType to Group; change to User / ServicePrincipal to match the request, or read the principal id from the request row instead of the env var.

Trigger source

The Dataverse trigger can be swapped for a Form/Freshservice front end that creates the request row; the rest of the flow is unchanged.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{toLower(concat(coalesce(triggerOutputs()?['body/flowlibs_teamname'],'team'),'-',coalesce(triggerOutputs()?['body/flowlibs_purpose'],'workload'),'-rg'))}

@{concat('/subscriptions/',parameters('EnvVar_AzureSubscriptionId'),'/resourceGroups/',variables('varResourceGroupName'))}

@{concat(parameters('EnvVar_ArmBaseUrl'),'/')}

@{concat('/subscriptions/',parameters('EnvVar_AzureSubscriptionId'),'/providers/Microsoft.Authorization/roleDefinitions/',parameters('EnvVar_RbacRoleDefinitionId'))}

@json(parameters('EnvVar_StandardTags'))

@int(parameters('EnvVar_DefaultBudgetAmount'))

@equals(outputs('Start_Landing_Zone_Approval')?['body/outcome'],'Approve')

@{first(outputs('Start_Landing_Zone_Approval')?['body/responses'])?['comments']}

Customize & download